CVE-2026-98855of/overlay: put property on deadprops only after changeset add succeeds
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: of/overlay: put property on deadprops only after changeset add succeeds add_changeset_property() links a new property of a not-yet-live target node into the node's deadprops list before handing it to of_changeset_add_property(). If that fails, the error path frees the property but leaves the freed pointer linked in deadprops, and of_node_release() frees it a second time when the aborted overlay's node is released. Record the changeset entry first and link the property into deadprops only on success. of_changeset_add_property() never looks at the node's property lists, so the order of the two steps is otherwise immaterial, and the error path frees a property that nothing references.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from f96278810150fc39085d1872e5b39ea06366d03e before d5151496a0a2b19c9c0c7b0ebf86b3de55a8fa3a; from f96278810150fc39085d1872e5b39ea06366d03e before 7dc6a769153c0457077a0da4888a00f61e66de15; from f96278810150fc39085d1872e5b39ea06366d03e before 5857035a3b53a4e7b5a0d5a740189901ece0b079; from f96278810150fc39085d1872e5b39ea06366d03e before 814f2da6995772c07a7c9c2cc6028b6e3f3ecc9c; b52ca352489be8beb7de3a8181509a0deaf72e21; from 4.19.49 before 4.20 | CNA record |
References
- https://git.kernel.org/stable/c/d5151496a0a2b19c9c0c7b0ebf86b3de55a8fa3a
- https://git.kernel.org/stable/c/7dc6a769153c0457077a0da4888a00f61e66de15
- https://git.kernel.org/stable/c/5857035a3b53a4e7b5a0d5a740189901ece0b079
- https://git.kernel.org/stable/c/814f2da6995772c07a7c9c2cc6028b6e3f3ecc9c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.